Attackers Can Steal Session Cookies and CSRF Protection Tokens via User Interaction
CVE-2024-31503

Currently unrated

Key Information:

Vendor

Dolibarr

Vendor
CVE Published:
17 April 2024

What is CVE-2024-31503?

Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.

References

https://github.com/alexbsec/CVEs/blob/master/2024/CVE-202...

Timeline

  • Vulnerability published

.